org.webjars.npm:adal-node (0.1.28), org.webjars.npm:azure__msal-node (1.5.0) +7 more potentially affected by CVE-2025-65945 via org.webjars.npm:jws (>=3.2.2, <=4.0.0)

org.webjars.npm:jws MAVEN version =3.2.2, =1.6.1, =2.3.2, =5.5.4, =0.0.1, =1.0.0 Source cves: CVE-2025-65945 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-14188254...

Wallarm Halts Remote Code Execution Exploits: Defense for Vulnerable React Server Component Workflows

On December 3, 2025, React maintainers disclosed a critical unauthenticated remote code execution RCE vulnerability in React Server Components RSC, tracked as CVE-2025-55182. A working PoC was released publicly, and Wallarm immediately began observing widespread exploitation attempts across...

Exploit for CVE-2025-55182

what's it For CVE-2025-55182 and CVE-2025-66478 Security Resp...

Exploit for CVE-2025-55182

CVE-2025-55182 and CVE-2025-66478 Technical Analysis of Ar...

com.sksamuel.scruffy:scruffy-integrationtest_2.11 (1.12.0), com.sksamuel.scruffy:scruffy-undertow_2.11 (>=1.9.0, <=1.12.0) +39 more potentially affected by CVE-2024-3884 via io.undertow:undertow-core (1.2.0.beta10)

io.undertow:undertow-core MAVEN version 1.2.0.beta10 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.sksamuel.scruffy:scruffy-integrationtest2.11 1.12.0 - com.sksamuel.scruffy:scruffy-undertow2.11...

Exploit for CVE-2025-55182

CVE-2025-55182 - React Server Components RCE Exploit Python C...

@amazeelabs/bridge-waku (>=1.1.9, <=2.0.1), @amazeelabs/executors (>=3.1.12, <=3.1.14) +8 more potentially affected by CVE-2025-55182 via react-server-dom-webpack (19.0.0)

react-server-dom-webpack NPM version 19.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @amazeelabs/bridge-waku =1.1.9, =3.1.12, =1.4.7, =1.1.3, =0.0.0-next-20250108080920, =0.0.0-next-20250108080920,...

DRUPAL-CONTRIB-2025-122

This module enables integration between Next.js and Drupal for headless CMS functionality. When installed, the module automatically enables cross-origin resource sharing CORS with insecure default settings Access-Control-Allow-Origin: , overriding any services.yml CORS configuration. This allows...

Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution

A maximum-severity security flaw has been disclosed in React Server Components RSC that, if successfully exploited, could result in remote code execution. The vulnerability, tracked as CVE-2025-55182, carries a CVSS score of 10.0. The vulnerability has been codenamed React2shell. It allows...

@adenta/cms (>=0.0.6, <=1.1.1-0), @alisonquinter17/alieta-ui (0.1.0) +124 more potentially affected by CVE-2025-55182 +1 more via next (>=15.4.0-canary.17, <=15.4.7)

next NPM version =15.4.0-canary.17, =0.0.6, =1.2.4-main.7f918ee.29, =1.0.0, =1.0.0-beta.3, =1.0.2, =0.0.1, =0.0.4, =0.0.1, =1.1.0, =0.1.3, =0.0.0-dev-20250910232631, =0.1.7, =0.1.8 and more Source cves: CVE-2025-55182, CVE-2025-66478 Source advisory: SNYK:JS-NEXT-14173355...

Arbitrary Code Injection

Overview @modern-js/utils is a progressive web framework based on React. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe deserialization of RSC payloads from HTTP requests to Server Function endpoints. An unauthenticated attacker can execute arbitrary code ...

@4399ywkf/router (>=0.0.1, <=0.0.4), @akash-aw/aw-wizard-forms (4.14.0) +129 more potentially affected by CVE-2025-55182 via @modern-js/utils (>=2.65.2, <=2.69.2)

@modern-js/utils NPM version =2.65.2, =0.0.1, =1.0.0, =1.0.0, =0.44.0, =2.23.0, =0.3.53, =1.0.1, =0.30.0, =0.3.0-alpha.1, =0.4.3, =1.3.0, =2.0.0 and more Source cves: CVE-2025-55182 Source advisory: SNYK:JS-MODERNJSUTILS-14723360...

Next.js - Critical - Access bypass - SA-CONTRIB-2025-122

This module enables integration between Next.js and Drupal for headless CMS functionality. When installed, the module automatically enables cross-origin resource sharing CORS with insecure default settings Access-Control-Allow-Origin: , overriding any services.yml CORS configuration. This allows...

Security Bulletin: IBM Edge Data Collector uses next-15.3.1.tgz which is vulnerable to CVE-2025-55173, CVE-2025-57752.

Summary IBM Edge Data Collector uses next-15.3.1.tgz which is vulnerable to CVE-2025-55173, CVE-2025-57752. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2025-55173 DESCRIPTION: Next.js is a React framework for building full-stack...

Malicious Package

Overview js-uponcaps is a malicious package. This package contains malicious code associated with a social engineering campaign called "Contagious Interview." The attackers target developers through fake job interviews or coding test assignments that require the installation of this package. Once...

Malicious Package

Overview bitcoin-lib-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in bitcoin-lib-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 480dbd7d7ec801a0212ee78ebb73268cd67ba4fb96b06ec563fbafe31aa10531 The package bitcoin-lib-js was found to contain malicious code. Source: ghsa-malware 95f79207062e8c5db317d3487c20f36927b99e9f0b9bfc2551c22a23d10c020f...

MAL-2025-191459 Malicious code in @vleo-dev/a11y-js-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf7b4a5742b82956cf1632de9f435f824ac60651023bec86e0f12d9689dc5b2c The package @vleo-dev/a11y-js-service was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199555

Malicious code in @vleo-dev/a11y-js-service npm...

Malicious code in @vleo-dev/a11y-js-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf7b4a5742b82956cf1632de9f435f824ac60651023bec86e0f12d9689dc5b2c The package @vleo-dev/a11y-js-service was found to contain malicious code. Source: ghsa-malware...